How Does PUSH Work Through a Firewall?
 

I have read GnuFU and the latest protocol specification I can find (0.4), but I have some questions about how PUSH works through a firewall or NAT box.

Case 1: Alice is connected to the Internet through a NAT box or firewall. She sees that Bob has a file she wants to download. Bob does not have a firewall. So Alice's client opens a TCP connection to Bob's machine and downloads the file. No problem.

Case 2: Same as #1 except that Bob wants to get a file from Alice. Bob's client cannot open a TCP connection to Alice's computer because it is behind a firewall. From what I have read, Bob's client needs to send a PUSH to Alice's machine. Alice's machine receives the PUSH, opens a TCP connection to Bob's machine, and sends the file to Bob. Do I have that correct?

My questions:
1) How does the PUSH packet get from Bob to Alice? Bob cannot send it directly, because he cannot open a TCP connection to Alice, because she is behind the firewall. Does it get cached somewhere? If so, how would Alice know to look for it?

2) Suppose Alice tries to push a file onto Bob's machine, but Bob had not requested that file. Does the servent on Bob's machine receive it anyway? Or does it reject the incoming file?

Thanks.